The Hague, November 2016

Changes in Modus Operandi of Islamic State

(IS) revisited

Contents

Contents ...................................................................................................... 2
Key Judgments.............................................................................................. 2
1. Introduction and background .................................................................... 3
2. Trends in Terrorism ................................................................................. 3
3. Emerging modus operandi ........................................................................ 6
4. Target selection ...................................................................................... 7
5. Perpetrators............................................................................................ 8
6. Choice of weapons .................................................................................. 10
7. The internet and social media .................................................................. 11
8. The impact of the situation outside the EU ................................................. 12
9. Terrorism and organised crime ................................................................. 12
10. Conclusions ........................................................................................ 14

Key Judgments

From an IS perspective, the terrorist attacks carried out in Belgium and France in 2015 and
2016 were successful and effective. Given this fact and a general assumption that IS retains
both the will and the capability to strike again, further attacks in the EU, both by lone actors
and groups, are likely to take place in the near future.

- In addition to France and Belgium, all other EU Member States that are part of the US-
led coalition against IS are prone to be attacked by terrorists led or inspired by IS.
Attacks may also be carried out to compromise Syrian refugees as a group and to
provoke Member States to change their policies towards them.

- The most probable scenario is the use of the same modus operandi, including the
same types of weapons, used in earlier attacks. This is because of the ease of
production, acquisition and use of such weapons/explosives, and their proven
effectiveness.

- If IS is defeated or severely weakened in Syria/Iraq by the coalition forces, there may

be an increased rate in the return of foreign fighters and their families from the region
to the EU or to other conflict areas, such as Libya. Those who manage to enter the EU
will pose a potential security risk for the Union. Given the high numbers involved, this
represents a significant and long-term security challenge.

Europol Public Information

 - IS is not the only terrorist organisation with the intent and capability to carry out
attacks against the West, or to inspire individuals and groups residing in EU Member
States to do so. Al-Qaeda and/or Al-Nusra affiliated or inspired groups and individuals
continue to pose a serious threat to Member States and to Western interests in
general.

1. Introduction and background

The recent attacks in Europe, carried out by Al-Qaeda (e.g. Paris, January 2015) and IS inspired
or affiliated individuals and groups (e.g. Paris, November 2015, Brussels, March 2016), have
increased concerns about possible future terrorist attacks by violent jihadist individuals and
groups in EU Member States. This report presents an overview of the terrorist threat as
perceived by the organisation and its main stakeholders, based on available information and
expert knowledge.

This report considers the terrorism threat from a law enforcement perspective and makes use
of Europols unique access to information relating to terrorism and serious and organised
crime. In preparation of the original report a meeting was organised with law enforcement
experts of EU Member States. This meeting was held under the Chatham House Rule and
took place in The Hague in July 2016. The report has subsequently been updated to reflect the
latest developments.

2. Trends in Terrorism

- Currently the EU is facing a range of terrorist threats and attacks: from networked
groups to lone actors; attacks directed by IS and those inspired by IS; the use of
explosives and automatic rifles as well as bladed weapons and vehicles; and carefully
prepared attacks alongside those that seem to be carried out spontaneously.
- EU Member States that participate in the anti-IS coalition are regarded by IS as
legitimate targets.
- France remains high on the target list for IS aggression in the EU, but so too do Belgium,
Germany, The Netherlands and the United Kingdom.

The main concern reported by EU Member States law enforcement agencies continues to be
jihadist terrorism and the closely related phenomenon of foreign terrorist fighters, travelling to
and from conflict zones1. The main terrorist group currently threatening the EU is Islamic State
(IS).

EU Member States that participate in the anti-IS coalition are regarded by IS as legitimate
targets. IS appears to have a preference for attacking soft targets as a means to instil
maximum fear in the general public. In 2015, 150 people were killed in jihadist terrorist attacks
in the EU, of which the majority were killed in France. The number of jihadist attacks increased
from 4 in 2014 to 17 in 2015 and the number of arrests for Jihadist terrorist activities increased
from 395 in 2014 to 667 in 2015, the latter illustrating the enormous counterterrorist efforts
being undertaken by authorities in Europe.

1
TE-SAT 2016

Europol Public Information

Estimates from some intelligence services indicate several dozen people directed by IS may be
currently present in Europe with a capability to commit terrorist attacks, and that there are
indications that IS has been preparing terrorist attacks in Europe since 2013.

The prime focus of IS was originally the seizure of territory and local resources. Its involvement
in international terrorism against the West was limited to attacks on tourists in Muslim-
majority countries (e.g. Tunisia and Egypt), and inspiring individuals in Europe (e.g. France, the
UK) and elsewhere (including the US and Australia) to perpetrate lone-actor terrorist attacks.
In March 2015, 22 people, most of them Western tourists, were killed in an attack on the
Bardo Museum in Tunis, Tunisia. Three months later, 38 people, most of them UK nationals,
were killed at a seaside hotel in Sousse, Tunisia.

Abu Muhammed Al-Adnani, the official spokesperson and senior leader of IS killed on 30
August 2016 in Aleppo (Syria), released a speech on 22 September 2014 entitled "Indeed, Your
Lord Is Ever Watchful", which was significant because it was the first known official instruction
by IS for its supporters to kill non-believers in Western countries, saying: If you can kill a
non-believing American or European especially the spiteful and filthy French or an
Australian, or a Canadian, or any other non-believer from the non-believers waging war,
including the citizens of the countries that entered into a coalition against the Islamic State,
then rely upon Allah, and kill him in any manner or way however it may be. Smash his head
with a rock, or slaughter him with a knife, or run him over with your car, or throw him down
from a high place, or choke him, or poison him.

The bomb attack on 31 October 2015 of an airplane, an Airbus A321 of the Russian airline
company Metrojet, carrying 224 passengers and crew from Egypt to Russia was a first
indication of a shift towards a broader international strategy of IS, of which the November
2015 Paris attacks and the March 2016 Brussels attacks are a direct result. By July 2016 IS has
been linked to over 100 terrorist plots against the West, defined as countries located in Europe
and North America, as well as Australia, or targets affiliated with those countries outside the
conflict zone in Syria and Iraq.

On 21 May 2016, IS media outlet al-Furqan Media released a new audio speech by Abu
Muhammed al-Adnani. In this he called on Muslims to dedicate the forthcoming holy month of
Ramadan (6 June 5 July 2016) to jihad and instilling fear in the hearts of unbelievers. In
particular, al-Adnani called upon IS supporters in America and Europe to kill unbelievers by any
means available to them in their place of residence, should they be prevented by the
tyrannical system (Western governments) from joining IS in the territory under its control. He
further specifically mentioned that civilian targets must be prioritised. According to al-Adnani
even the smallest acts to terrorise unbelievers in the West have a big impact, since the aim is
to fill the lives of Westerners with terror so the neighbour fears his neighbour.

According to IS, the worst enemies of Islam are those within. The group argues that focusing
on the far enemy (the West) and ignoring the near one (Muslim enemies in the region,
especially Shia) is ineffective. Hence the large numbers of deadly attacks IS has been carrying
out in Turkey and Middle Eastern countries, specifically Syria and Iraq; attacks against Muslims
in Muslim countries have caused casualties that far outnumber those caused by attacks in the
West. IS is currently operational in 18 countries, including Algeria, Libya, Yemen, Saudi Arabia,
Afghanistan, Pakistan, Bangladesh, Nigeria and in countries in the Caucasus. In July 2016
after al-Adnanis call to dedicate Ramadan in jihad and instilling fear in the hearts of
unbelievers IS claimed to have killed and wounded 5,200 people around the world during the
month of Ramadan, including in that figure the attacks in Orlando (USA) and Magnanville
(France). It presented the tally as an infographic in the 38th issue of its al-Naba weekly

Europol Public Information

newspaper for the Hijri year 1437, which was distributed on Telegram and Twitter on 12 July
2016. According to the infographic, IS fighters killed and wounded a total of 1,988 Shi'ites, 965
Kurds, 752 Fajr Libya elements, 580 Syrian forces, and 282 "Crusaders, among others. It also
listed 14 of the "most significant" operations in the month of Ramadan, including the Orlando
shooting, the Magnanville attack, the five-man suicide raid at the Holey Artisan Bakery cafe in
Bangladesh , the suicide bombing at the Rukban army post in Jordan , and suicide attacks in
Hadramawt, Yemen.

Among the Islamist terrorist organisations known to EU law enforcement agencies, IS is one of
the few that explicitly targets Western countries. This is not to say that other violent Jihadist
groups are not anti-Western and will never aim to attack Western individuals or interests
when a specific opportunity arises or when they see a cause. Al-Qaeda is still a factor to be
considered as the attack on the editors of Charlie Hebdo in Paris in January 2015 showed -
and a reason for the EU to focus on a broader range of religiously inspired groups.

There have been IS inspired or IS directed attacks in Belgium, Denmark, Germany and the UK2
in the recent past, and IS is believed to be focussing on all countries that are part of the anti-IS
coalition, but since the Toulouse and Montauban shootings in March 20123 France appears to
be high on the target list for IS aggression in the EU. This is illustrated by the November 2015
Paris attacks and the lone actor attacks committed in 2016, referred to in the next pages.

A wide range of possible explanations for the elevated threat to France have been considered.
These include:
- France is a symbol of Western culture, among those countries where key concepts such as
freedom, democracy, human rights and the separation between religion and state
were first articulated.
- The countrys close engagement with the Muslim world, including Algeria, Iraq, Lebanon
and Syria, and the countrys continuing economic and military interventions to defend its
national interests in Africa and the Near East, bring the country into conflict with jihadist
groups.
- IS has an obsession with history and honour, and blames France in particular for the break-
up of the Ottoman Empire4 and the abolition of the Caliphate following the First World
War.
- France has a strong secular tradition and passed laws in 2004 (banning people from
wearing conspicuous religious signs in schools), and in 2010 (forbidding people from hiding
their faces in public areas), which were seen by many as specifically targeting Muslims.
- Levels of social and economic isolation in certain urban areas with a high representation of
Muslim citizens have created conditions in which some young people, especially those
with a history of crime, have become vulnerable to recruitment by violent jihadist groups;
- A high number of French jihadists having travelled to Syria /Iraq as foreign terrorist fighters
(FTFs).

2
Andrew Parker, head of MI5, confirmed on 31 October 2016 that UK security authorities have foiled
twelve attempted attacks in the UK in the last three years (https://www.theguardian.com/uk-
news/2016/nov/01/andrew-parker-mi5-director-general-there-will-be-terrorist-attacks-in-britain-
exclusive, retrieved 4 November 2016)
3
The Toulouse and Montauban shootings in March 2012 were a series of three gun attacks targeting
French soldiers and Jewish civilians in the cities of Montauban and Toulouse in France. In total, seven
people were killed, and five others were injured, four seriously. The perpetrator was identified as
Mohammed Merah, a 23-year-old French petty criminal of Algerian descent. He was shot and killed after
a 30-hour siege with police.
4
Germany and France in 1913, and Germany and Britain in 1914, reached agreement over the division
of the Ottoman Empire into spheres of influence.

Europol Public Information

Some of the same reasons also apply to Belgium and to its capital Brussels in particular.
Brussels has become home to radicalized milieus; Muslims make up 6% of the Belgian
population but that figure is 25% in Brussels and 40% in Molenbeek, where the unemployment
rate among immigrants is more than 30%. With 560 FTFs, Belgium has the highest number per
capita in the EU.

Germany, meanwhile, may be considered a target of IS because of the large influx of Syrian
refugees in the country, belying the promise of the Caliphate as an Islamic utopia.

3. Emerging modus operandi

- Terrorists acting in the name of IS are able to plan relatively complex attacks including
those on multiple targets quickly and effectively
- The scale and impact of lone actor attacks is increasing
- Modi operandi employed in Syria and Iraq, such as the use of car bombs, may emerge
as a method of attack in the EU

The Paris (13 November 2015) and Brussels (22 March 2016) attacks have shown that
terrorists acting in the name of IS, and possibly steered by its central command in Syria, are
able to plan relatively complex attacks quickly and effectively. In both series of attacks use was
made of suicide bombs, and were executed at places with lots of people present as potential
victims (a football stadium, a theatre, a metro station, an airport). In the case of Zaventem
airport in particular, the attacks were carried out in a venue of international character, causing
a multiplier effect aimed at generating worldwide media attention. Relatively complex, these
attacks were not particularly expensive to organise (although it is very difficult to evaluate the
real costs), but nevertheless highly effective and carried out in easily repeatable modi
operandi. The attack with a truck on civilians celebrating 14 July in Nice, leaving 85 dead and
several hundreds wounded, showed the devastating potential of a lone-actor attack5,
employed by IS inspired or directed terrorists. This attack was carried out with even simpler
means and was even more difficult to predict or foresee, let alone prevent. Pro IS accounts on
social media celebrated the attack in Nice. Related messages many of which were made in a
coordinated fashion - expressed the belief that IS was responsible for the attack, before the
attack had been claimed by any group.

Circumstances differ considerably between EU countries and those in the Middle East and
North Africa. These have an impact on IS operations in Syria and Iraq and in EU countries. The
modi operandi jihadists employ in Syria and Iraq, however, may be exported to the EU at some
point. Exploring new modi operandi is regarded as a hallmark of IS. One example is the use of
suicide bombings in the Paris and Brussels attacks in 2015 and 2016, which IS had not used
before outside their geographical area of operations. Other possibilities in the future include
the use of car bombs, extortion and kidnappings. It is believed that the group responsible for
the Paris and Brussels attacks had plans to produce explosives to be concealed in a car and to
be detonated, probably somewhere in France. Police actions reportedly forced them to modify
their plans. The suicide attacks in public places show similarities in tactics, techniques and
procedures to those which had been previously utilised by jihadist terrorists outside the EU.

5
According to open source information, the driver of the truck was supported by a group of facilitators /
supporters, who helped him preparing the attack

Europol Public Information

The attacks resembled in particular those in Mumbai, India in November 2008 in terms of
modus operandi, targets chosen, numbers of attackers and impact6.

Al-Qaeda, which still represents a significant threat in jihadist terrorism, issued an audio
interview on 23 July 2016 in which its leader, Ayman al-Zawahiri called on fighters to take
Western hostages and exchange them for jailed jihadists. In the recording posted on-line, al-
Zawahiri called on the global militant network to kidnap Westerners until they liberate the last
Muslim male prisoner and last Muslim female prisoner in the prisons of the Crusaders,
apostates and enemies of Islam.

4. Target selection

- Lone actors no longer typically choose symbolic targets

- Terrorists have a preference for soft targets
- Apart from the loss of life, terrorist attacks also have an economic impact

IS is known to direct some terrorist plots and inspire others. Amongst the attacks primarily
inspired by IS are those committed by lone actors. Until recently, lone actors typically chose
symbolic targets, including from the police and military, as shown in the attack committed by a
French national born in Burundi, who attacked three police officers with a knife in a police
station in Joue les Tours on 20 December 2014; the stabbing of two police officers in
Melbourne (Australia) by an 18-year old on 23 September 2014; a man driving his car into two
soldiers in Canada, killing one of them, on 20 October 2014; and more recently the stabbing of
a French police commander and his wife near and in their home near Paris on 13 June 2016;
and the attack on two female police officers in Charleroi (Belgium). Currently, lone actor
attacks appear to be targeted at soft targets as well, with the aim of causing mass casualties.
The attacks believed to have been directed from Syria are those that are exclusively aimed at
soft targets with the intention of causing indiscriminate mass casualties.

Indiscriminate attacks have a very powerful effect on the public in general, which is one of the
main goals of terrorism: to seriously intimidate a population. This preference for soft targets
means that attacking critical infrastructure such as power grids, nuclear facilities and
transportation hubs is currently not a priority. The same applies to cyber-attacks, because of
the relatively low impact on the general public such attacks would generate. This is regardless
of the level of damage that could be caused and the impact a successful cyber-attack might
have on the security of a state, the economy and society as a whole. The consensus among
national counter-terrorism authorities is that the cyber capabilities of terrorist groups are still
relatively low, even though recent developments among terrorist affiliated cyber groups might
indicate an attempt to build up resources and develop expertise. The possibility of terrorist
affiliated cyber groups engaging in cyber warfare sponsored by Nation States those with
capacities to engage in this type of attacks should not be discounted.

Apart from the loss of life, terrorist attacks also have an economic impact. Travel and tourism
are already suffering. Tunisia, Egypt and Turkey are facing declining numbers of tourists
because of the attacks that have recently taken place, specifically directed at foreign visitors.
Hotel bookings in Brussels and Paris showed a sharp fall in the aftermath of the attacks in both
cities and cities elsewhere are also affected. Amsterdam is expecting that fewer tourists will
visit the city in 2016 because of the fear of terrorism. Costs of security measures have
increased significantly and foreign investments may suffer. In this context IS has expressed its
delight over the economic impact on the UK and EU following the British referendum and

6
TE-SAT 2016

Europol Public Information

called for attacks in Berlin and Brussels to "paralyse" Europe. This illustrates an awareness by
IS of the economic impact terrorist major attacks may have, and their perceived role in
weakening Western economies.

5. Perpetrators

- Radicalised persons are not necessarily profound believers

- Elements of the (Sunni Muslim) Syrian refugee diaspora may become vulnerable to
radicalisation once in Europe and may be specifically targeted by Islamic extremist
recruiters
- The majority of attacks claimed by IS appear to be masterminded and perpetrated by
individuals inspired by IS, rather than those who work with the organisation directly
- Intelligence suggests that IS has assembled teams in Syria which are sent to the EU
tasked with carrying out attacks
- Training possibilities for IS are believed to be decreasing in Syria

In general terms, jihadists committing terrorist acts in the EU can be described as a particular
group of mainly young men who have a criminal past, are or feel discriminated, humiliated and
marginalised in society, with some also having mental health issues, who are not strictly
practising their Islam religion, but have radicalised in a very short period, either through
intervention of recruiters or on their own, inspired by the narratives publicised by the so-called
Islamic State (IS) on internet, and subsequently decide to travel to Syria or Iraq, or decide to
become a soldier of IS in their country of residence.

The people in question are mostly subjects of self-radicalisation and therefore difficult to
detect. They are not necessarily very religious: they may not read the Quran and may not be
regular visitors of a mosque. There have been examples of 16 and 17-year olds who tried to act
like Islamists rather than being Islamists, and had no sound knowledge of Islam. To have only a
fragmented and very subjective knowledge of Islam may make them more dangerous. Mental
or identity problems, lack of education, unemployment and an inferiority complex can make
them vulnerable to radicalisation and recruitment, offering a sense of social belonging and
emotional fulfilment. Triggering events may include, but are not limited to world events (e.g.
foreign intervention against the country of origin, persecution of members of ones own
community (ethnic, political, religious), loss of job or recurrent failure to get one, dropping out
from school, experiencing a personal humiliation and the death of a loved-one, close friend or
relative 7. Pathological fixation on individuals or causes may play a role in leaving a person
isolated and destitute and therefore prone to use violence8. Religion may thus not be the
initial or primary driver of the radicalisation process, but merely offering a window of
opportunity to overcome personal issues. They may perceive that a decision to commit an
attack in their own country may transform them from zero to hero.

The majority of attacks carried out in the name of IS appear to have been masterminded and
performed by individuals who were inspired by IS, rather than those who worked with the
terrorist organisation directly. Intelligence suggests, however, that IS has also put together
teams in Syria which are sent to the EU tasked with carrying out attacks. It is believed that this
external terrorism network, began sending fighters abroad two years ago. At least 10 deadly
attacks against Westerners have been directed or coordinated by this special unit dedicated to

7
ISEC Project Enhancing the Cooperation of Law Enforcement Agencies in Combating Self
Radicalisation: Handbook on Radicalisation and Warning Behaviours, 2016
8
idem

Europol Public Information

exporting terror abroad, according to a former jihadist interviewed by the New York Times9. He
referred to Emni as the external operations service within IS to carry out attacks abroad.
Emn or amn is Arabic for "security". In Arab countries, amn is also used to refer to
security/intelligence services, which generally also have executive powers in the sense of a
secret police.

The man who allegedly coordinated the November 2015 Paris attacks is believed to have made
several journeys between Europe and Syria. In June-July 2015 several terrorists travelled from
Syria to Europe by air. There is no firm evidence that terrorist travellers systematically use the
flow of refugees to enter Europe unnoticed, but it is indisputable that some have entered the
EU posing as refugees. The jihadists using the migration flows may only be expendable
footmen, while highly trained and expert operatives may be provided with genuine or false
travel documents and use more sophisticated routes. Illegal travel options carry the risk of
detention and/or of being taken to another country rather than the intended destination, and
therefore remove the element of control from the terrorists hands. On the other hand, they
may prefer irregular travel in order to embed sleeper cells or simply to conceal their
movements10.

Facial recognition techniques used in the comparison of persons in refugee camps with
photographs retrieved from the conflict areas have produced hits, identifying individuals who
are suspected to have been involved in hostile activities (either coerced or of their own
consent). IS is known to facilitate the travel of operatives by providing them with counterfeit
or falsified (sometimes even genuine) travel documents. The group has a full stock of stolen
blank Syrian passports and is believed to have access to skilled falsifiers. Also the use of look-
a-likes has been reported, i.e. travelling on somebody elses genuine identity document.
Meanwhile, it is reasonable to expect increase in the rate of return of foreign terrorist fighters
(FTFs) from the conflict zones back to the EU, in order to extend their terrorist activities to the
EU, but also as a result of the deteriorating situation for IS in the conflict area, and out of
frustration with IS practice in some cases. Some may also locate to other conflict areas.

Given that it is in the interests of IS to inflame the migration crisis to polarise the EU
population and turn sections of it against those seeking asylum, there is a risk of some
infiltration of refugee camps and other groups. The extent of this is unknown, however,
making the subject susceptible to exaggeration and exploitation especially by populist factions
and (extreme) right-wing parties. A real and imminent danger is the possibility of elements of
the (Sunni Muslim) Syrian refugee diaspora becoming vulnerable to radicalisation once in
Europe and being specifically targeted by Islamic extremist recruiters. It is believed that a
number of jihadists are travelling through Europe for this purpose. According to unconfirmed
information, German authorities were aware of around 300 recorded attempts made by
jihadists to recruit refugees who were trying to enter Europe by April 2016.

Next to the threat of major attacks by terrorists allegedly acting on instructions from IS central
command in Syria, such as those witnessed in Paris and Brussels and those that have not taken
place thanks to timely intervention by law enforcement authorities, other attacks are carried
out by clean skins, lone actors that are self-radicalised individuals not associated with known
extremists and not known to security services, presenting a current and imminent danger.
Lone actors operate individually or in rare cases with one or two accomplices, do not belong to
a terrorist organisation, act without influence of a leader, plan their own agenda including
attacks, and undergo their own radicalisation process. In some lone-actor attacks it may be

9
http://www.nytimes.com/2016/08/04/world/middleeast/isis-german-recruit-interview.html?_r=0,
retrieved 4 November 2016
10
Frontex, Risk Analysis for 2016

Europol Public Information

difficult to establish whether the objective was to commit a terrorist or criminal act, a quest
for personal significance induced by personal circumstances, ideology or social pressure, or
whether it was the result of mental disorders.

Training possibilities for IS are believed to be decreasing in Syria, where IS is losing ground and
under high pressure from the military activities of coalition forces. The number of individuals
travelling to the conflict zones in Syria and Iraq has diminished significantly over the past year,
possibly for these reasons, and because increasing numbers of individuals of interest to the
authorities have been incarcerated. As a result the emphasis of IS involvement with (potential)
violent jihadists in the West seems to be shifting from training to coaching primarily self-
taught operatives. Of particular concern is the outlook for women and children associated
with foreign terrorist fighters, who may have travelled with them to Syria or (in the case of the
children) have since been born there. These children are being confronted with radical ideas
and extreme violence through training and exposure to the violent acts of IS combatants at
very early ages, which is likely to affect their development. If IS is defeated or severely
weakened in Syria/Iraq by the coalition forces, there may be an increased rate in the return of
foreign fighters, their families (wives and children) that have spent time in the conflict areas,
perhaps having even taken part in hostilities, and also of other people that have fought
alongside IS attempting to travel to the EU. Those who are successful in entering the EU pose a
threat in that they may want to continue their attempts to destabilise the West by committing
terrorist attacks. Given the high numbers of radicalised Europeans who have joined IS in the
conflict area, counted in the thousands, their en masse or even sporadic return would
represent a long-term and highly difficult security challenge for the EU.

6. Choice of weapons

- Automatic firearms remain the weapons of choice of terrorist cells

- TATP (Triacetone Triperoxide) is a home-made explosive which for years has been, and
is likely to remain, the explosive of choice by terrorists
- There is evidence that IS has shown an interest in the use of chemical and/or biological
weapons

Despite the efforts of IS to explore new modi operandi, automatic firearms still seem to be the
weapons of choice of terrorist cells committing large scale attacks, because of their relative
ease of access, use and effectiveness. Firearms can be obtained from criminal sources, in some
cases from those the terrorists already know from their own criminal past. In addition it is
possible to obtain firearm parts legally via the internet, as well as de-activated firearms to be
converted back later for operational use. The current situation concerning the availability of
illegal weapons in countries neighbouring the EU, particularly in Ukraine and the Western
Balkan countries but also in current conflict zones, may lead to a significant number of those
weapons becoming available via the black market, posing a significant threat in the near
future11.

The explosives used in the Paris and Brussels attacks were TATP (Triacetone Triperoxide), a
home-made explosive which for years has been, and in the near future probably will continue
to be, the explosive of choice for terrorists. It is relatively simple to make from commonly
available ingredients and difficult to detect. Instructions on how to produce TATP can be
found on the internet on Jihadist websites and e-magazines (e.g. INSPIRE, DABIQ).

11
TE-SAT 2016

Europol Public Information

Commercial explosives are difficult for terrorists to acquire, but the conditions for obtaining
them differ according to national legislation. Military explosives are even harder to access, but
explosive remnants of war (ERW) and illicit trafficking in explosives from former conflict areas
are nevertheless believed to present a significant threat to the EU. A number of large
shipments of illegal military-grade firearms and explosives, mostly from the Western Balkan
countries, were seized in organised crime investigations in 2015. Terrorists are known to have
acquired hand grenades, rocket launchers, and high-grade plastic explosives and detonators
from organised crime groups. Explosive ordnance has also been acquired by theft from military
explosive storage facilities and through the illegal collection of ERW and unexploded ordnance
(UXO) from former battle zones12.

The use of home-made, commercial or military explosives in vehicle-born improvised explosive

devices (VBIEDs) by various factions in Syria and Iraq has not been used yet by jihadist terrorist
attacks in EU Member States. Given the fact that modi operandi used in Middle Eastern
countries tend to be copied by terrorists operating in Europe, and that other terrorist groups
(e.g. Northern-Irish Republican groups and ETA) have already set an example, it is conceivable
that jihadist groups will use this means at some stage. Indeed, that is believed to have been
the intention of those involved in the Paris and Brussels attacks. It is also possible that IS will
consider the use of chemical and/or biological weapons in the EU at some stage. IS is known to
have used sulphur mustard gas in Syria and is thought to be able to produce the gas itself. IS is
believed to include people who were formerly engaged in Iraqs weapons programme and it is
assumed that the group has access to Iraqi and Libyan storage sites of chemical weapons. In
addition there are indications that IS is experimenting with biological weapons. On 18 February
2016 Moroccan authorities dismantled an IS cell planning attacks potentially involving
chemical weapons. Police arrested 10 persons and confiscated a cache of weapons originating
from Libya, consisting of automatic machine guns, revolvers and a rifle. The authorities also
recovered toxic biological and chemical substances and a large stock of agricultural fertilizer
with high sulphur content. The substances found could have been used to produce home-
made explosives. Furthermore, three jars were seized containing a substance that could be
transformed into a deadly tetanus toxin.13 The Moroccan Interior Ministry confirmed, that
some of the seized substances are classified by international organisations which specialise in
health issues as falling within the category of biological weapons, dangerous for their capacity
to paralyse and destroy the nervous system and cause death. It further added that the security
officers had foiled what would have been a catastrophic and dangerous IS attack in the
country.

What we have seen to date, however, is that terrorists use the weapons that are most easily
available. Lone actors have therefore used knifes, axes and machetes, cars and even a truck to
commit their acts. The effectiveness, ease of use and access of these weapons will continue to
be relevant.

7. The internet and social media

- Individuals and groups involved in terrorist and extremist activities use encryption to
conceal their communications from law enforcement and intelligence agencies
- Terrorists use different platforms in their communication and switch between them or
use parallel platforms to obfuscate their exchanges

12
TE-SAT 2016
13
Various open sources reported, such as http://www.independent.co.uk/news/world/africa/isis-cell-
had-been-preparing-chemical-attack-in-morocco-a6886121.html

Europol Public Information

Terrorist groups continue to use the internet and social media extensively, mainly for
dissemination of propaganda material but also for recruitment and fundraising. Over the past
two years, they appear to have revised their communication strategies, adapting to efforts
made by social media platforms and authorities to contain their online activities. IS employs a
successful propaganda strategy based on messages that are tailored to different audiences. Its
scope is global, aiming to reach out to vulnerable populations across the continents. The group
has created a number of media outlets transmitting propaganda productions in several
languages, adjusted for the cultural background of each target group. IS members of several
nationalities appear in video messages calling on their compatriots to join the group or to carry
out terrorist attacks in their countries of residence.

Individuals and groups involved in terrorist and extremist activities use encryption in order to
conceal their communications by law enforcement and intelligence agencies, leaving them
only the meta-data to work with. Terrorist groups encourage their followers to cover their
traces with such software. Al-Qaeda and IS have gone as far as to develop their own tools.
However, the use of these seems to be waning. More recently, terrorists, like other criminals,
are exploiting the opportunities for secure communication provided by smartphone
applications and other software, thereby abusing the efforts made by companies to ensure
privacy and data protection for their customers. The development and accessibility of such
software provide terrorists with the opportunity to communicate covertly without the burden
of developing and maintaining their own tools. Terrorist groups publicise numerous detailed
guides about how to remain anonymous and use mainstream tools and apps securely14.

Terrorists are known to use different platforms in their communication and switch between
them or use parallel platforms to obfuscate their exchanges. Telegram, Instagram and Twitter
are often used, along with secret accounts on Facebook and the use of the deep web. Apps are
used once and then abandoned. Another technique that has been known for a long time is to
draft emails without sending them, so that different people using the same email credentials
can read them without running the risk of interception by third parties.

8. The impact of the situation outside the EU

- Libya could develop into a springboard for IS

CT experts are concerned that Libya could develop into a second springboard for IS, after Syria,
for attacks in the EU and the North African region. Since mid-2015 Libya has become a major
destination for IS fighters in its own right and is believed to having become a hub for EU
foreign terrorist fighters who, on returning to Europe, plan further terrorist attacks. Despite
recently being driven from its stronghold in Sirte, IS is believed to still have a powerbase in the
country, in which there are large stockpiles of weapons and unlimited places in which jihadists
could be trained for future terrorist attacks. CT experts expect that IS will start planning and
dispatching attacks from Libya if the current phase, in which they are primarily focused on
taking territory and disposing of local enemies, comes to an end.

9. Terrorism and organised crime

- 816 individuals reported to Europol for terrorism-related offences have also been
reported for involvement in serious and/or organised crime
- Almost all of those were first reported for offences related to serious and/or organised
crime and only later in terrorism-related cases

14
TE-SAT 2016

Europol Public Information

- Information from the investigations into the 13 November 2015 Paris attacks suggests
that IS members might have had an active participation in criminal networks
- Contacts between terrorists and career criminals are generally of a very pragmatic and
opportunistic character, and for very specific purposes only

A significant number of individuals (816 by 27 July 2016) have been reported to Europol both
for terrorism-related offenses and for involvement in serious and/or organised crime. 67% of
the suspects reported for terrorism in the first six months of 2016 with links to serious and/or
organised crime were reported as foreign fighters (539 out of 816). The average age of these
persons is 33 years. 90% of these persons are male.

Most of the suspects reported for both terrorism and serious and/or organised crime are EU
nationals. A large number of them were born outside the EU and later obtained EU nationality.
Most are European nationals from Belgium, The Netherlands, the United Kingdom and France.
The most frequently contributed non-EU nationals in both terrorist- and serious and/or
organised crime databases at Europol originate from Syria and Morocco. Belgium is the most
frequently reported country of birth for these persons, followed by Iraq and Syria. The
individuals identified in both fields were reported as being involved in various crime areas,
including migrant smuggling, drug and firearms trafficking, financial crime and organised
property crime. Almost all of them were first reported for offences related to serious and/or
organised crime and only later for terrorism-related offences, suggesting that individuals
involved in criminal activities and socialised in a criminal environment are amenable to
radicalisation processes. These persons are typically involved at a low level in organised crime
and do not fill major roles within organised crime networks. However, their involvement in
serious and/or organised crime may provide these people with contacts, access to firearms,
financial means and transportation. In addition, their involvement in crime demonstrates a
willingness to engage in unlawful behaviour and may indicate a lower threshold to actively
engage in violent actions in the context of their radicalisation.

Terrorist groups can, at times, resort to common crime to generate funds which are then used
to cover the costs associated with the planning and execution of attacks, such as recruitment,
procurement and travel. Alternatively, they may seek contact with common criminals or
organised crime groups to access greater financial resources, weapons, transport means,
specialist skills or a larger pool of potential recruits.

Suspects reported for both criminal activities and terrorism who engage in drug trafficking or
organised property crime for their own financial benefit often do so on an ad hoc and
temporary basis. Terrorism suspects who use their involvement in crime to provide substantial
financial support or financial services such as money laundering typically rely on long-standing
and trustful relationships with actors in terrorist groups as well as organised crime networks.

Given that some of the individuals related to terrorist offences are brought up and socialised in
a criminal environment, it makes sense to assume they retain their links to their criminal
environment after radicalisation. While most interactions between individuals involved in
criminal activities and terrorist actors are believed to be pragmatic, ad hoc and short-term,
others may be sustained and longer-term as these individuals inhabit an intersection of the
criminal underworld between radicalised actors and individual criminals, crime groups and
networks. Information from the investigations into the 13 November 2015 attacks suggests
that some of the attackers might have had an active participation in criminal networks, instead
of just being their clients.

Europol Public Information

Overall it seems that contacts between terrorists and career criminals are generally of a very
pragmatic and opportunistic character, and for very specific purposes only. The relative
incidence of such cases in which there are connections, however, appears to have increased. It
is in both the criminals and the terrorists best interests to keep their contacts to the
minimum and to cease contact as soon as transactions are completed, for both to avoid the
attention of law enforcement and specifically for career criminals to avoid the unwanted
attention of intelligence services. Their rationales are also totally different; terrorists such as
those related to IS want to destabilise society, whereas criminals operate within their existing
environment.

10. Conclusions

The EU is currently witnessing an upward trend in the scale, frequency and impact of terrorist
attacks in the jurisdictions of Member States. France in particular has recently been hit hard by
a series of terrorist attacks, perpetrated both by groups of terrorists and lone actors. IS is
actively propagating terrorist acts on EU soil by any means available, increasingly inspiring
radicalised individuals to act. IS has proven to be very effective in both moving people to
commit terrorist acts and to set these actions in motion themselves.
The success generated by these terrorist attacks, as seen from an IS perspective, will
encourage the group to hit more targets in the EU. Although France appears to be the primary
focus of IS, the organisation has threatened all countries that are part of the US led coalition
against IS in Syria and Iraq, including Germany, the UK and other Member States, which have
specifically been mentioned as enemies of IS in several video messages.
What should not be overlooked is that IS is not the only terrorist organisation with the intent
and capability to carry out attacks against the West, or to inspire individuals and groups
residing in EU Member States to do so. Al-Qaeda and/or Al-Nusra affiliated or inspired groups
and individuals continue to pose a serious threat to Member States of the EU and to Western
interests in general.
New attacks by both terrorist groups and lone actors are thus to be expected, most probably
following the patterns that have been used in earlier attacks. New variations in attack, for
example in the use of car bombs, may also develop.
The continuous increase in arrests and court proceedings across the EU for terrorism related
offences of a jihadist nature is proof of the high priority assigned to counter terrorism in law
enforcement and the judiciary. The need for enhanced information exchange is increasingly
acknowledged and addressed. But as long as IS remains a factor in Syria and Iraq, and even if
they are defeated there, they will continue with their attempts to encourage and organise
terrorist attacks in the EU.

Europol Public Information